Server crashes

[VowOfSilence]

Hello

I'm new to this forum and have a problem I hope you can help me with

I have a sever with OVH, this one to be precise

http://www.ovh.co.uk/individual/products/kimsufi08.xml

But I'm having problems. I'm pretty sure that µTorrent makes the server crash, but I don't know why and was hoping you guys could help me out

The OS is Windows 2003 Server Standard SP2 Edition distribution.

Tell me if you need more information

Thanks in advance

[Firon]

Without more info on the crash itself, there's nothing we can do. Examine the minidumps that Windows creates with windbg.

If configured properly, Windows will create them in %SystemRoot%\minidump

[thelittlefire]

What version were you using? What throughput were you getting? People can max 100Mbit symmetric with 1.7, but crashing usually is a sign of some instability. Double check the software and hardware.... if the hardware is slow (not likely a problem from the primer) you can use 1.8's variable cache and better management capability.

[VowOfSilence]

I'm running with µTorrent 1.7.7. I'm can't tell if the bandwidth was maxed any of the times, because the server crashes within a few minutes, but I doubt it. I've just done a new installtion of Windows, only things installed are Firefox and µTorrent.

I've communicated with the support at OVH and they concluded that the hardware is working fine.

Here's what I got for a crash that happened today

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini072608-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: c:\windows\symbols
Executable search path is: 
Unable to load image \WINDOWS\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows Server 2003 Kernel Version 3790 (Service Pack 2) UP Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Kernel base = 0x80800000 PsLoadedModuleList = 0x808af9c8
Debug session time: Sat Jul 26 01:46:14.011 2008 (GMT+2)
System Uptime: 1 days 5:31:35.968
Unable to load image \WINDOWS\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
..........................................................................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C5, {ed790ae5, d0000002, 1, 8089bce3}

*** WARNING: Unable to verify timestamp for hal.dll
Unable to load image \WINDOWS\system32\DRIVERS\PCIIDEX.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for PCIIDEX.SYS
Unable to load image atapi.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for atapi.sys
*** WARNING: Unable to verify timestamp for ACPI.sys
*** WARNING: Unable to verify timestamp for CLASSPNP.SYS
Unable to load image PartMgr.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for PartMgr.sys
Unable to load image ftdisk.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ftdisk.sys
Unable to load image volsnap.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for volsnap.sys
*** WARNING: Unable to verify timestamp for Ntfs.sys
*** WARNING: Unable to verify timestamp for fltmgr.sys
Probably caused by : Unknown_Image ( nt!KiTrap0E+aa )

Followup: MachineOwner
---------

!analyze -v
kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is
caused by drivers that have corrupted the system pool.  Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: ed790ae5, memory referenced
Arg2: d0000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8089bce3, address which referenced memory

Debugging Details:
------------------


BUGCHECK_STR:  0xC5_D0000002

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KiTrap0E+aa
8082645c ??              ???

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

PROCESS_NAME:  System

TRAP_FRAME:  f78c2c04 -- (.trap 0xfffffffff78c2c04)
ESP EDITED! New esp=e2128c40
ErrCode = 00000000
eax=85f9f600 ebx=f78c2c90 ecx=c0227e40 edx=c0227e40 esi=008c2c6c edi=00000000
eip=89f90000 esp=f78c2c78 ebp=8082671d iopl=0         nv up di pl nz na po nc
cs=0000  ss=0010  ds=41a0  es=41a0  fs=0000  gs=f688             efl=00000000
89f90000 ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from 8089bce3 to 80836de5

STACK_TEXT:  
f78c2324 8089bce3 badb0d00 00000022 f78c2388 nt!IoMakeAssociatedIrp+0xa4
f78c23d4 80a7eff3 00000000 00000000 206c6148 nt!KiDoubleFaultStack+0x1433
f78c23fc 80a7f322 85fa61b0 85fa52e0 00000108 hal!HalHandleNMI+0x105
f78c242c f74a8a5b 85fa61b0 85fa52e0 85c44920 hal!HalpPCIWriteUshortType1+0x34
f78c2460 f7389f70 85fa5398 4a310000 00010000 PCIIDEX!BmSetup+0x5f
f78c2498 8082e109 85f4d028 85bdd798 85bdd798 atapi!IdePortStartIo+0x142
f78c24bc f7389e20 85f4d028 85bdd798 00000000 nt!CcFlushCache+0x573
f78c24ec 80840153 85f4d028 00bdd798 f743939c atapi!IdePortDispatch+0x53a
f78c2500 f74393c6 f743939c f78c253c f7439bb2 nt!ExRemoveHeadNBQueue+0x66
f78c250c f7439bb2 85fb79e8 85bdd798 85bdd798 ACPI!ACPIDispatchForwardIrp+0x2a
f78c253c 80840153 85fb79e8 f7450294 f743939c ACPI!ACPIDispatchIrp+0x15a
f78c2550 f74393c6 f743939c f78c258c f7439bb2 nt!ExRemoveHeadNBQueue+0x66
f78c255c f7439bb2 85fb39e8 85bdd798 85714398 ACPI!ACPIDispatchForwardIrp+0x2a
f78c258c 80840153 85fb39e8 f7450294 85bdd930 ACPI!ACPIDispatchIrp+0x15a
f78c25a0 f7351607 85bdd930 4a310000 f78c25e4 nt!ExRemoveHeadNBQueue+0x66
f78c25b0 f73512b2 85bdd930 85fb20e8 857144e0 CLASSPNP!SubmitTransferPacket+0xbb
f78c25e4 f7351533 00000000 00010000 85714398 CLASSPNP!ServiceTransferRequest+0x1e4
f78c2608 80840153 85fb2030 00000000 85f3ab40 CLASSPNP!ClassReadWrite+0x159
f78c261c f74c80cf 85f448d0 85714504 f78c2640 nt!ExRemoveHeadNBQueue+0x66
f78c262c 80840153 85fb6b10 85714398 85714528 PartMgr!PmReadWrite+0x95
f78c2640 f73f7053 85714398 85fa7a18 85714398 nt!ExRemoveHeadNBQueue+0x66
f78c265c 80840153 85f44818 85714398 8571454c ftdisk!FtDiskReadWrite+0x1a9
f78c2670 f73a08bc 85fa6248 e1e97da0 85f43020 nt!ExRemoveHeadNBQueue+0x66
f78c2688 80840153 85f43020 85714398 85714398 volsnap!VolSnapRead+0x52
f78c269c f7276a62 f78c2980 f78c2880 f72768d9 nt!ExRemoveHeadNBQueue+0x66
f78c26a8 f72768d9 f78c2980 85f43020 cefe8000 Ntfs!NtfsSingleAsync+0x91
f78c2880 f7277156 f78c2980 85714398 e1e97da0 Ntfs!NtfsNonCachedIo+0x2db
f78c296c f7277079 f78c2980 85714398 00000001 Ntfs!NtfsCommonRead+0xaf5
f78c2b18 80840153 85ec1020 85714398 85f46f38 Ntfs!NtfsFsdRead+0x113
f78c2b2c f732fc45 85f46f38 00000000 85ee210a nt!ExRemoveHeadNBQueue+0x66
f78c2b54 80840153 85ee21f8 85714398 85714398 fltmgr!FltpDispatch+0x6f
f78c2b68 80824b6f 85c448f8 85f9f660 85c448e8 nt!ExRemoveHeadNBQueue+0x66
f78c2b80 8082645c 856fc90a 85c44920 85c44900 nt!KiTrap06+0xec
f78c2b80 89f90000 856fc90a 85c44920 85c44900 nt!KiTrap0E+0xaa
WARNING: Frame IP not in any known module. Following frames may be wrong.
8082671d 00000000 00000000 00000000 00000000 0x89f90000


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiTrap0E+aa
8082645c ??              ???

SYMBOL_STACK_INDEX:  21

SYMBOL_NAME:  nt!KiTrap0E+aa

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP:  0

BUCKET_ID:  INVALID_OPCODE

MODULE_NAME: Unknown_Module

Followup: MachineOwner
---------

And here's one a couple of days old

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini071608-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: c:\windows\symbols
Executable search path is: 
Unable to load image \WINDOWS\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows Server 2003 Kernel Version 3790 (Service Pack 2) UP Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Kernel base = 0x80800000 PsLoadedModuleList = 0x808af9c8
Debug session time: Wed Jul 16 03:52:02.869 2008 (GMT+2)
System Uptime: 0 days 3:45:55.860
Unable to load image \WINDOWS\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...........................................................................................
Loading User Symbols
Loading unloaded module list
......
Unable to load image \SystemRoot\system32\DRIVERS\tcpip.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for tcpip.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {f, d0000002, 0, f6e412d8}

*** WARNING: Unable to verify timestamp for afd.sys
Probably caused by : tcpip.sys ( tcpip!CopyRBChain+1c4 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000f, memory referenced
Arg2: d0000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: f6e412d8, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS:  0000000f 

CURRENT_IRQL:  2

FAULTING_IP: 
tcpip!CopyRBChain+1c4
f6e412d8 ??              ???

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR:  0xD1

PROCESS_NAME:  uTorrent.exe

LAST_CONTROL_TRANSFER:  from f6e412d8 to 80836de5

STACK_TEXT:  
f64db910 f6e412d8 badb0d00 00000eb0 f6eabee0 nt!IoMakeAssociatedIrp+0xa4
f64db9b8 f6e4244f 852326f8 853e4008 f64dba1c tcpip!CopyRBChain+0x1c4
f64dba14 f6e42381 852326f8 00000800 853ca008 tcpip!BufferData+0x364
f64dba40 f6e4138b f64dba00 00000020 84b72fa4 tcpip!TdiReceive+0x298
f64dba78 f6e4d071 84e837c4 84b72fa0 f64dbc9c tcpip!TCPReceiveData+0x78
f64dba94 80840153 85ecec88 84b72ee8 853977a8 tcpip!TCPDispatchInternalDeviceControl+0x7c
f64dbaa8 f6dbda00 f64dbbf0 0000000f f64dbb1c nt!ExRemoveHeadNBQueue+0x66
f64dbb10 f6db14fb 84f2f7a8 00000000 f6db14fb afd!AfdFastConnectionReceive+0x247
f64dbc5c 8092b332 8532a680 00000001 0104fe68 afd!AfdFastIoDeviceControl+0x655
f64dbc90 00000000 0016019f 00000000 00003ef2 nt!CmpAllocateDelayItem+0xea


STACK_COMMAND:  kb

FOLLOWUP_IP: 
tcpip!CopyRBChain+1c4
f6e412d8 ??              ???

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  tcpip!CopyRBChain+1c4

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: tcpip

IMAGE_NAME:  tcpip.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  485bbca9

FAILURE_BUCKET_ID:  0xD1_tcpip!CopyRBChain+1c4

BUCKET_ID:  0xD1_tcpip!CopyRBChain+1c4

Followup: MachineOwner
---------

[Firon]

Looks like a driver is crashing it. Probably the NIC's drivers. That, or the NIC itself is screwed.

[VowOfSilence]

Hmm. I've written to the support at OVH saying there was a NIC problem. They told me to update the NIC drivers, but there were no updates in Windows Update. I also referred them to this thread, but they're still saying it's my fault the server keeps crashing.

Can you help me or do you have any other suggestions what's wrong?

[Switeck]

What half open value are you using in uTorrent?

And what settings in general are you using in uTorrent?

...Lastly, how much bandwidth do you have to work with?

These alone shouldn't cause a crash of that magnitude, but if you can't fix the unstable hardware...it's still worth a check to see if uTorrent's settings may be a bit much for the connection it's running on.

[VowOfSilence]

I have a 100 Mbit/s connection, my settings are on the screenshots below

[Switeck]

Check uTorrent's advanced settings...half open limit probably still needs to be only 8 max.

uTorrent's special features are probably too much for the server's weak networking hardware or software.

I mean DHT, UPnP, Local Peer Discovery, and Resolve IPs.

If you don't need them, try disabling them.

1000 global connections at once is another potential overkill for the server. It *SHOULDN'T* be for good hardware+software, but the bluescreens you've had is proof enough they don't have that.

[xXxJamxesyxXx]

i normally use "Driver Detective" to update all my drivers, even ones i don't know about and its quick and easy updates all the drivers you need =) without crashing, so that would be a best bet for you > VowOfSilence < as you would need to update any drivers that ain't on windows update!

hope this helps you out a bit..

[VowOfSilence]

Driver Detective just fucked up my server so now I have to reinstall the OS..

I will get back to you when it's reinstalled Switeck